Mebroot Fixtool

Mebroot Fixtool is designed to detect and remove a MBR rootkit known as Trojan.Mebroot that infects the Master Boot Record (MBR), stores the rootkit driver in the physical drive sectors, and hides the true contents of all sectors both from user-mode code and also from anti-rootkits.

This latest sample of Mebroot uses powerful anti-rootkit techniques designed to render most anti-rootkits useless in their battle against Mebroot.

FixMebroot v1.01 runs only on Windows XP.

To disinfect a PC infected with the latest version of Mebroot (first reported 10 July 2008) please follow these steps:

• Install Spyware Doctor and run Smart Update to ensure you have database version 1025 or later
• Download and run the Mebroot Fixtool to remove the rootkit and repair the MBR
• Reboot the PC
• Then run a scan using Spyware Doctor to detect and remove the files related to the threat.

Note: Currently this program only runs under Windows XP.